Information processing apparatus, information processing method, and computer-readable recording medium

This application is a continuation application of International Application No. PCT/JP2023/024530, filed on Jun. 30, 2023 which claims the benefit of priority of the prior Japanese Patent Application No. 2023-033211, filed on Mar. 3, 2023, the entire contents of each are incorporated herein by reference.

The present invention relates to an information processing apparatus, an information processing method, and an information processing program.

Conventionally, incident management using log information has been performed. For example, log information is analyzed to grasp the damage situation from information such as the source of the incident, the communication destination, and the authentication history.

The related technique has a problem of a difficulty in quickly handling an incident while suppressing cost. For example, due to the need to perform analysis by matching a plurality of pieces of log information, a large amount of labor and time are required for the analysis. In addition, there is a case of taking measures disregarding the cost in order to solve the problem at an earlier stage.

The present invention has been made in view of the above, and aims to provide an information processing apparatus, an information processing method, and an information processing program capable of achieving quick incident handling and cost reduction.

It is an object of the present invention to at least partially solve the problems in the related technology.

According to an aspect of the embodiments, an information processing apparatus includes: processing circuitry configured to: acquire a security log including information regarding unauthorized communication stored in an upper network device being a device constituting an overlay network, an authentication log stored in a cloud server, and a communication log stored in a lower network device being a device constituting an underlay network; specify information such that, when the authentication log includes a connection source internet protocol (IP) address that does not exist in the communication log acquired and the security log includes information regarding an access not permitted to be used from the connection source IP address, the processing circuitry specifies the information regarding the access as unauthorized communication; and give an instruction to block the unauthorized communication specified.

The above and other objects, features, advantages and technical and industrial significance of this invention will be better understood by reading the following detailed description of presently preferred embodiments of the invention, when considered in connection with the accompanying drawings.

Hereinafter, embodiments of an information processing apparatus, an information processing method, and an information processing program according to the present application will be described in detail with reference to the drawings. Note that the present invention is not limited by the embodiment. In the description of the drawings, the same portions are denoted by the same reference numerals, and redundant description is omitted.

1 FIG. 1 FIG. First, a related technique will be described with reference to.is a diagram for illustrating a related technique. In the following, a device constituting an overlay network will be denoted as an upper network (NW) device, while a device constituting an underlay network will be denoted as a lower NW device. Here, the upper NW device refers to, for example, a cloud proxy server or Unified Threat Management (UTM) equipment. The lower NW device refers to, for example, a network device such as Deep Packet Inspection (DPI) equipment, a router, and a switch.

In the conventional security countermeasures, networks are divided into a reliable “inside” and an unreliable “outside”, and countermeasures are taken at the boundary. An example of the inside network is a data center connected by an in-house local area network (LAN) or a virtual private network (VPN), and an example of the outside network is the Internet. For example, as a countermeasure taken at the boundary, security equipment such as a firewall, a proxy, or an Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) is installed at the boundary to monitor and control the communication, thereby blocking a cyberattack from the outside.

Such prior security measures assume that data and systems to be protected are inside the network. However, with the spread of the cloud, it is not unusual that there is a target to be protected on the Internet on the outside. In this manner, the targets to be protected are scattered in various locations to blur the boundary, making it difficult to take sufficient measures with a conventional mindset.

In view of this circumstance, the concept of zero trust is spreading. In the zero trust security service, various security countermeasures are taken on the assumption that all communications are not to be trusted. Specific examples of this include enhancement of user authentication by encryption of a communication path regardless of the inside and outside of the network, use of multi-factor authentication, and the like, and integrated log monitoring of the network and various devices connected to the network. A large number of security solutions for implementing the zero trust have already emerged. For example, there has been provided a solution such as Endpoint Detection and Response (EDR) that enables quick detection and handling of a cyberattack by monitoring a client device and analyzing a log.

Under such circumstances, incident management using log information has been conventionally performed. For example, log information is analyzed to grasp the damage situation from information such as the source of the incident, the communication destination, and the authentication history.

However, the related technique has a problem of a difficulty in quickly handling an incident while suppressing cost. For example, when an incident occurs, there is a need to collect individual pieces of log information such as an occurrence source, a communication destination, and an authentication history stored in the upper NW device, the lower NW device, or the like, and accurately grasp a damage situation caused by the incident. However, it is necessary to perform analysis by matching pieces of log information in which information is not integrated by a device unit, an identification (ID) unit, or the like, which requires a lot of labor and time. In addition, there is a case of taking measures disregarding the cost in order to solve the problem at an early stage.

100 121 123 121 123 124 123 In view of this situation, an information processing apparatusaccording to an embodiment includes: an acquirerthat acquires a security log including information regarding unauthorized communication (for example, malicious communication) stored in an upper NW device being a device constituting an overlay network, an authentication log stored in a cloud server, and a communication log stored in a lower NW device being a device constituting an underlay network; a specifierthat specifies information such that, when an authentication log includes a connection source IP address that does not exist in the communication log acquired by the acquirerand a security log includes information regarding an access not permitted to be used from the connection source IP address, the specifierspecifies the information regarding the access as unauthorized communication; and a blocking instructorthat gives an instruction to block the unauthorized communication specified by the specifier.

With such a configuration, it is possible to have effects such as quick incident handling and cost reduction.

1 100 Furthermore, an information processing systembeing a system including the information processing apparatusprovides a zero trust security service unique to a provider (carrier). The zero trust security uses a configuration in which the underlay NW and the overlay NW cooperate to perform protection in an Information and Communication Technology (ICT) environment with increased complexity and cyber risk by new ways of working such as working remote and new business expansion by utilization of Internet of Things (IoT) and the like.

1 1 1 The information processing systemprovides a secure Network as a Service (NaaS) type ICT service closely linking the function of the overlay NW and the function of the underlay NW. A company that receives the service of the information processing systemcan easily start, revise, and cancel the service of the information processing systemimmediately by applying from a management portal site without spending a cost for Information Technology (IT) vendor outsourcing or spending a cost for NW design, making it possible to reduce operational cost taken from design to application.

1 1 Regarding the information processing system, the overlay NW and the underlay NW are provided by the same provider. In addition, the user who uses the information processing systemcan perform flexible use of the system, for example, using only the overlay NW of this system and using another company for the underlay NW.

Configuration of Information Processing Apparatus

100 100 110 120 130 2 FIG. 2 FIG. Next, a configuration of the information processing apparatuswill be described with reference to. As illustrated in, the information processing apparatusincludes a communication module, a control module, and a storage module. Note that these modules may be held by a plurality of devices in a distributed manner. Hereinafter, processing of these modules will be described.

110 120 110 120 The communication moduleis implemented by a Network Interface Card (NIC) or the like, and enables communication between the control moduleand an external device via a telecommunications link such as a LAN or the Internet. For example, the communication moduleenables communication between the control moduleand the upper NW device or the lower NW device.

130 130 The storage moduleis implemented by a semiconductor memory element such as Random Access Memory (RAN) or flash memory, or a storage device such as a hard disk or an optical disk. The information stored in the storage moduleincludes, for example: information related to authentication (hereinafter, denoted as “authentication log” or “cloud log” as appropriate), information related to security (hereinafter, denoted as “security log” as appropriate), information related to communication (hereinafter, denoted as “communication log” or “NW log” as appropriate), information related to unauthorized communication, information regarding the upper NW device, information regarding the lower NW device, other information necessary for specifying unauthorized communication, and other information necessary for blocking unauthorized communication.

Here, the security log is, for example, a log related to unauthorized communication detected by the upper NW device. The authentication log is, for example, a log related to an authentication request received by the cloud server. The communication log is, for example, flow data of each network device being a lower NW device.

Furthermore, the information related to authentication includes, for example, information such as date/time when authentication is requested, an ID, a connection source IP address/port, and an authentication result. Furthermore, the information related to the security includes, for example, information such as a detection date/time, a detection type, a connection destination IP address/port, and a connection source IP address/port of suspicious communication suspected as unauthorized communication detected by the cloud proxy.

130 Furthermore, the information related to communication includes, for example, information such as a date/time of each communication, a connection destination IP address/port, a connection source IP address/port, a protocol, and the number of bytes transferred. Note that the information stored in the storage moduleis not limited to the example described above.

120 120 121 122 123 124 120 2 FIG. The control moduleis implemented by using a Central Processing Unit (CPU), a Network Processor (NP), a Field Programmable Gate Array (FPGA), or the like, and executes a processing program stored in the memory. As illustrated in, the control moduleincludes an acquirer, an output part, a specifier, and a blocking instructor. Hereinafter, each part included in the control modulewill be described.

121 121 The acquireracquires a security log being information regarding unauthorized communication stored in the upper NW device, an authentication log stored in the cloud server, and a communication log stored in the lower NW device. For example, the acquireracquires information such as a detection date/time, a detection type, a connection destination IP address/port, and a connection source IP address/port as the security log stored in the upper NW device, acquires information such as a date/time, an ID, a connection source IP address/port, and an authentication result as the authentication log stored in the cloud server, and acquires information such as a date/time, a connection destination IP address/port, a connection source IP address/port, a protocol, and the number of bytes transferred as the communication log stored in the lower NW device.

122 121 122 121 The output partoutputs information obtained by matching the security log, the authentication log, and the communication log acquired by the acquirer. For example, the output partperforms matching of the information related to authentication, the information related to security, and the information related to communication acquired by the acquirerfor each terminal or for each identification information.

123 121 123 The specifierspecifies unauthorized communication by using the information related to authentication, the information related to security, and the information related to communication, which have been acquired by the acquirer. For example, when an IP address that does not exist in the information related to communication exists in the information related to authentication and when information related to security includes information regarding an access from the IP address not permitted to access, the specifierspecifies the information regarding the access as unauthorized communication. Here, “not permitted” means that having not been set as an IP address permitted to access.

121 123 For example, when the IP address “192.0.2.222”, which does not exist in the information related to communication out of the information acquired by the acquirer, exists in the information related to authentication, and when the information related to security includes information regarding an access from the IP address “192.0.2.222” not permitted to access, the specifierspecifies the information regarding the access as unauthorized communication.

123 123 123 For example, the specifiercompares a connection source IP address included in the security log with a connection source IP address included in the communication log, and determines whether the communication log includes log information in which a connection source IP address and a connection source IP address included in the security log are the same. In addition, the specifiercompares the connection source IP address included in the security log with a connection source IP address included in the authentication log, and determines whether the authentication log includes log information in which the connection source IP address and the connection source IP address included in the security log are the same. When having determined that the connection log includes no log information in which a connection source IP address and a connection source IP address included in the security log are the same, and the authentication log includes log information in which a connection source IP address and a connection source IP address included in the security log are the same, the specifierspecifies the log information of the connection source IP address included in the security log as unauthorized communication.

123 More specifically, for example, the specifierfirst compares a connection source IP address included in the security log with information regarding a connection source IP address included in the communication log, and determines whether the communication log includes log information in which a connection source IP address “192.0.2.222” and a connection source IP address included in the security log are the same.

123 Subsequently, the specifiercompares the connection source IP address included in the security log with information regarding the connection source IP address included in the authentication log, and determines whether the authentication log includes log information in which the connection source IP address “192.0.2.222” and the connection source IP address included in the security log are the same.

123 As a result, when having determined that the communication log includes no log information containing a same source IP address as “192.0.2.222” included in the security log, and determined that the authentication log includes log information containing a same source IP address as “192.0.2.222” included in the security log, the specifierspecifies the log information of a source IP address “192.0.2.222” included in the security log, specifically, “Detection date/time: 2023/1/23 17:59:38, Detection type: Storage service access, Connection destination IP: Port: 203.0.113.111:443, Connection source IP: Port: 192.0.2.222:11663”, as unauthorized communication.

124 123 124 123 124 123 The blocking instructorgives an instruction to block the unauthorized communication specified by the specifier. For example, the blocking instructorgives an instruction to block unauthorized communication by using identification information associated with the unauthorized communication specified by the specifier. For example, the blocking instructorblocks the unauthorized communication by instructing an external device (such as the upper NW device) to block communication in which an account indicated by identification information (ID) “1234567” associated with unauthorized communication specified by the specifieris a communication destination or a communication source.

124 123 124 123 124 123 In addition, for example, the blocking instructormay give an instruction to block the unauthorized communication by using the information regarding the IP address of the unauthorized communication specified by the specifier. More specifically, the blocking instructormay instruct the upper NW device to block the communication to the connection destination IP address “203.0.113.111” of the unauthorized communication specified by the specifier. Furthermore, for example, the blocking instructormay instruct the upper NW device to block the communication from connection source IP address “192.0.2.222” of the unauthorized communication specified by the specifier.

Outline of Processing Performed by Information Processing Apparatus

100 100 3 5 FIGS.to 3 5 FIGS.to Next, processing performed by the information processing apparatuswill be described with reference to.are diagrams for illustrating an outline of processing performed by the information processing apparatus.

121 121 1 2 3 3 FIG. 4 FIG. 4 FIG. 4 FIG. 4 FIG. The acquireracquires a security log being information regarding unauthorized communication stored in the upper NW device, an authentication log stored in the cloud server, and a communication log stored in the lower NW device. In the example of, the acquireracquires a security log, an authentication log (cloud log), and a communication log (NW log). Here, the security log is a log of information detected by a cloud proxy or the like of the upper NW device (for example, suspicious communication such as access to an external storage service from an unauthorized IP address), and includes information such as a detection date/time, a detection type, a connection destination IP: Port, and a connection source IP: Port. The authentication log is a log of authentication information, and includes information such as date/time, ID, connection source IP: Port, and an authentication result. The communication log is a communication log of the underlay NW, and includes information such as date/time, connection destination IP: Port, connection source IP: Port, a protocol, and the number of bytes transferred. In the example of,() corresponds to the communication log,() corresponds to the security log, and() corresponds to the cloud log.

122 121 122 Subsequently, the output partperforms matching of pieces of information regarding the cloud log, the security log, and the NW log acquired by the acquirerand outputs the result. For example, the output partdisplays the information regarding the cloud log, the security log, and the NW log that has undergone matching for each IP address or identification information.

100 1 3 2 123 4 FIG. 4 FIG. 4 FIG. 4 FIG. Furthermore, the information processing apparatususes each piece of information to specify/block unauthorized communication. In the example of, when the IP address “192.0.2.222” that does not exist in the communication log (()) as the information related to communication exists in the authentication log (()) as the information related to authentication, and when the information regarding the access from the IP address “192.0.2.222” not permitted to access exists in the security log (()) as the information related to security, the specifiersuspects that the case is an unauthorized login and specifies the information regarding the access as unauthorized communication.

123 1 2 3 5 FIG. 5 FIG. 5 FIG. 5 FIG. Subsequently, specification of unauthorized communication by the specifierwill be described with reference to.() illustrates information recorded in the security log.() illustrates information recorded in the communication log.() illustrates information recorded in the authentication log.

123 123 1 2 5 FIG. 5 FIG. For example, the specifierfirst compares the security log with the communication log, and determines whether there is a communication log in which a connection source IP address and a connection source IP address included in the security log are the same. More specifically, the specifiercompares the connection source IP address included in the security log illustrated in() with the information regarding the connection source IP address included in the communication log illustrated in(), and determines that communication in which the connection source IP address “192.0.2.222” and the connection source IP address included in the security log are the same does not exist in the communication log within a certain period from the detection date/time “2023/1/23 17:59:38” of the detected security log information.

123 123 1 3 5 FIG. 5 FIG. Subsequently, the specifiercompares the security log with the authentication log, and determines whether there is an authentication log in which a connection source IP address and a connection source IP address included in the security log are the same. More specifically, the specifiercompares the connection source IP address included in the security log illustrated in() with the information regarding the connection source IP address included in the authentication log illustrated in(), and determines that communication in which the connection source IP address “192.0.2.222” and the connection source IP address included in the security log are the same exists in the authentication log within a certain period from the detection date/time “2023/1/23 17:59:38” of the detected security log information.

123 1 2 3 123 1 5 FIG. 5 FIG. 5 FIG. 5 FIG. When a communication having the same connection source IP address as the detected security log does not exist in the communication log but exists in the authentication log, the specifierspecifies the detected information as unauthorized communication. More specifically, based on the fact that the log information same as connection source IP address “192.0.2.222” included in the security log illustrated in() does not exist in the communication log illustrated in() but exists in the security log illustrated in(), the specifierspecifies the log information of connection source IP address “192.0.2.222” included in the security log illustrated in(), namely, “Detection date/time: 2023/1/23 17:59:38, Detection type: Storage service access, Connection destination IP: Port: 203.0.113.111:443, Connection source IP: Port: 192.0.2.222:11663”, as unauthorized communication.

4 FIG. 4 FIG. 124 123 4 124 123 The description returns toagain. The blocking instructorsets the upper NW device not to permit authentication from an ID associated with the unauthorized communication specified by the specifier, thereby instructing the upper NW device to freeze the ID and block unauthorized communication. More specifically, as illustrated in(), the blocking instructorsets the upper NW device not to permit authentication from ID “1234567” associated with the unauthorized communication specified by the specifier, thereby freezing the ID and giving an instruction on the blocking of the unauthorized communication.

100 In this manner, when there is an authentication log of a communication coming from a different connection source IP address such as an external NW and not existing in the communication log of the underlay NW, and when the upper NW device in the overlay NW has detected access to the external storage service not permitted to access from the connection source IP address, the information processing apparatussuspects that the case is an unauthorized login from a location different from the underlay NW, and locks the account.

124 123 124 123 124 123 At this time, as an instruction to block unauthorized communication, in addition to freezing of the ID, the blocking instructormay also give an instruction to block unauthorized communication by using information regarding an IP address of the unauthorized communication specified by the specifier. More specifically, the blocking instructorinstructs the upper NW device to block the communication of unauthorized communication to connection destination IP address “203.0.113.111” specified by the specifier, thereby instructing the upper NW device to block unauthorized communication. Furthermore, for example, the blocking instructorinstructs the upper NW device to block communication from connection source IP address “192.0.2.222” of the unauthorized communication specified by the specifier, thereby instructing the upper NW device to block the unauthorized communication.

122 1 6 4 1 4 4 122 2 3 122 6 FIG. 6 FIG. 6 FIGS. 4 FIGS. 6 FIG. 6 FIG. 6 FIG. 6 FIG. Here, the matching processing performed by the output partwill be described with reference to.illustrates matching between the authentication log and the security log.() to() are the same as() to(), respectively. Referring to the example of, for example, the output partacquires Connection source IP address (denoted as “connection source IP” in) “192.0.2.222” related to the unauthorized communication included in the security log (()) and Detection date/time “2023/1/23 17:59:38”, and performs matching with information of the authentication log (()) using the connection source IP address “192.0.2.222” as a key. Subsequently, as a result of the matching, the output partextracts information regarding ID “1234567” corresponding to the connection source IP address “192.0.2.222” included in the authentication log, and the authentication date/time “2023/1/23 17:59:30” at which the authentication has been performed.

6 FIG. 6 FIG. 6 FIG. 5 122 122 As illustrated in(), the output partthen collectively outputs the extracted information, including ID “1234567”, the connection source IP address “192.0.2.222”, the authentication date/time (denoted as “authentication” in) “2023/1/23 17:59:30”, and the detection date/time (denoted as “security” in) “2023/1/23 17:59:38”, as one record. That is, by outputting the information that has undergone the matching performed by the processing described above, the output partcan output information that can be confirmed by comparing the detection result of the unauthorized communication in the security log with the authentication result in the authentication log, making it possible to reduce the burden on the system administrator when analyzing the cause of the incident, leading to achievement of quick incident handling and cost reduction.

Flowchart

100 7 FIG. Next, a flow of processing performed by the information processing apparatuswill be described with reference to. Note that the following steps can be executed in different orders, and may include processing to be omitted.

121 101 121 First, the acquireracquires a security log being information regarding unauthorized communication stored in the upper NW device, an authentication log stored in the cloud server, and a communication log stored in the lower NW device (Step S). For example, the acquireracquires information such as a detection date/time, a detection type, a connection destination IP address/port, and a connection source IP address/port as the security log stored in the upper NW device, acquires information such as a date/time, an ID, a connection source IP address/port, and an authentication result as the authentication log stored in the cloud server, and acquires information such as a date/time, a connection destination IP address/port, a connection source IP address/port, a protocol, and the number of bytes transferred as the communication log stored in the lower NW device.

122 121 102 122 121 Next, the output partoutputs information obtained by matching the information related to authentication, the information related to security, and the information related to communication, which have been acquired by the acquirer(Step S). For example, the output partperforms matching of the information related to authentication, the information related to security, and the information related to communication acquired by the acquirerfor each identification information.

123 103 123 103 100 Subsequently, the specifierdetermines whether there is a communication log having a connection source IP address same as the connection source IP address of the security log (Step S). Here, when the specifierdetermines that there is a communication log having the connection source IP address same as the connection source IP address of the security log (Step S“YES”), the information processing apparatusends the processing.

123 103 123 104 In contrast, when the specifierdetermines that there is no communication log having the connection source IP address same as the connection source IP address of the security log (Step S“NO”), the specifierdetermines whether there is an authentication log having the connection source IP address same as the connection source IP address of the security log (Step S).

123 104 100 123 104 123 121 105 Here, when the specifierdetermines that there is no authentication log in which the connection source IP address and the connection source IP address of the security log are the same (Step S“NO”), the information processing apparatusends the processing. In contrast, when the specifierdetermines that there is an authentication log in which the connection source IP address and the connection source IP address of the security log are the same (Step S“YES”), the specifierdetermines that the authentication log includes a connection source IP address not existing in the communication log acquired by the acquirerand determines that the security log includes information regarding an access that is not permitted to be used from the connection source IP address, and then specifies the information regarding the access as unauthorized communication (Step S).

124 123 106 124 123 Subsequently, the blocking instructorgives an instruction to block the unauthorized communication specified by the specifier(Step S). For example, the blocking instructorgives an instruction to block unauthorized communication by using identification information included in the unauthorized communication specified by the specifier.

100 121 123 121 123 124 123 The information processing apparatusaccording to the embodiment includes: the acquirerthat acquires a security log including information regarding unauthorized communication stored in the upper NW device being a device constituting an overlay network, an authentication log stored in the cloud server, and a communication log stored in the lower NW device being a device constituting the underlay network; the specifierthat specifies information such that, when the authentication log includes a connection source IP address that does not exist in the communication log acquired by the acquirerand the security log includes information regarding an access not permitted to be used from the connection source IP address, the specifierspecifies the information regarding the access as unauthorized communication; and the blocking instructorthat gives an instruction to block the unauthorized communication specified by the specifier.

100 Since the information processing apparatususes this configuration to collect and merge individual pieces of information, making it possible to quickly grasp the communication destination in units of ID and IP address even at occurrence of an incident, leading to dramatical enhancement of the accuracy of investigation of the cause and the response speed in handling and countermeasures. In addition, human cost required for incident handling is greatly reduced.

100 Furthermore, in a case where there is access information suspected of unauthorized login in the collected and merged information, the information processing apparatusspecifies and blocks the communication as unauthorized communication. This reduces time and effort required for analyzing each piece of information and examining an action for an analysis result, leading to achievement of quick handling of an incident and cost reduction.

123 100 123 123 The specifierof the information processing apparatusaccording to the embodiment compares a connection source IP address included in the security log with a connection source IP address included in the communication log, and determines whether the communication log includes log information in which a connection source IP address and a connection source IP address included in the security log are the same. In addition, the specifiercompares the connection source IP address included in the security log with a connection source IP address included in the authentication log, and determines whether the authentication log includes log information in which the connection source IP address and the connection source IP address included in the security log are the same. When the connection log includes no log information in which a connection source IP address and a connection source IP address included in the security log are the same, and the authentication log includes log information in which a connection source IP address and a connection source IP address included in the security log are the same, the specifierspecifies the log information of the connection source IP address included in the security log as unauthorized communication.

100 100 With this configuration, when there is access information suspected of unauthorized login in the collected and merged information, the information processing apparatusdetermines whether information regarding a connection source IP address of the access information exists in the communication log or the authentication log. In a case where the access information exists only in the authentication log, the information processing apparatusspecifies the access information as unauthorized communication and blocks the communication. This reduces time and effort required for analyzing each information and examining an action for an analysis result, leading to achievement of quick handling of an incident and cost reduction.

100 122 121 The information processing apparatusaccording to the embodiment includes the output partthat outputs information obtained by matching the logs acquired by the acquirer, namely, the security log, the authentication log, and the communication log.

100 With this configuration, the information processing apparatusoutputs information that is collected from each device and has undergone matching, making it possible to reduce the burden on the system administrator in analyzing the cause of the incident, leading to quick handling of the incident and cost reduction.

124 100 123 The blocking instructorof the information processing apparatusaccording to the embodiment gives an instruction to block unauthorized communication by using the identification information included in the unauthorized communication specified by the specifier.

100 With this configuration, the information processing apparatustakes measures such as not permitting authentication from an ID of unauthorized communication, leading to achievement of quick handling of the incident and cost reduction.

Program

100 It is also possible to create a program in which the processing executed by the information processing apparatusin the above embodiment is described in a language executable by a computer. In this case, by execution of the program by the computer, effects similar to those of the above embodiment can be obtained. Furthermore, the program may be recorded in a computer-readable recording medium, and the program recorded in the recording medium may be read and executed by the computer to implement processing similar to the above-described embodiment.

8 FIG. 8 FIG. 1000 1010 1020 1030 1040 1050 1060 1070 1080 is a diagram illustrating an example of a computer that executes an information processing program. As illustrated in, a computerincludes, for example, memory, a CPU, a hard disk drive interface, a disk drive interface, a serial port interface, a video adapter, and a network interface. These units are connected to each other via a bus.

1010 1011 1012 1011 1030 1090 1040 1100 1100 1050 1110 1120 1060 1130 The memoryincludes read only memory (ROM)and RAM. The ROMstores, for example, a boot program such as a Basic Input Output System (BIOS). The hard disk drive interfaceis connected to a hard disk drive. The disk drive interfaceis connected to a disk drive. For example, the disk driveis a drive into which a removable storage medium such as a magnetic disk or an optical disk is inserted. For example, the serial port interfaceis connected to a mouseand a keyboard. For example, the video adapteris connected to a display.

8 FIG. 1090 1091 1092 1093 1094 1090 1010 Here, as illustrated in, the hard disk drivestores an operating system (OS), an application program, a program module, and program data, for example. Each table described in the above embodiment is stored in the hard disk driveor the memory, for example.

1090 1000 1093 1000 1090 Furthermore, the information processing program is stored in the hard disk driveas, for example, a program module describing commands to be executed by the computer. Specifically, the program moduledescribing each processing to be executed by the computerdescribed in the above embodiment is stored in the hard disk drive.

1090 1020 1093 1094 1090 1012 Furthermore, data used for information processing performed by the information processing program is stored as program data in the hard disk drive, for example. The CPUreads the program moduleand the program datastored in the hard disk driveto the RAMas necessary, and executes each procedure described above.

1093 1094 1090 1020 1100 1093 1094 1020 1070 The program moduleand the program datarelated to the information processing program are not limited to the form of being stored in the hard disk drive, and may be stored in a removable storage medium and read by the CPUvia the disk driveor the like, for example. Alternatively, the program moduleand the program datarelated to the control program may be stored in another computer connected via a network such as a LAN or a Wide Area Network (WAN) and read by the CPUvia the network interface.

Others

Various embodiments, described herein in detail with reference to the drawings as a plurality of embodiments, are merely examples and are not intended to limit the present invention to the plurality of embodiments. The features described herein may be implemented by various methods, including various modifications and improvements based on the knowledge of those skilled in the art.

In addition, the “terms such as a part (a module or a noun with suffix -er or suffix -or)” described above can be read as a unit, a means, a circuit, or the like. For example, a communication module, a control module, and a storage module can be replaced with a communication unit, a control unit, and a storage unit, respectively.

According to the present invention, quick incident handling and cost reduction can be achieved.

Although the invention has been described with respect to specific embodiments for a complete and clear disclosure, the appended claims are not to be thus limited but are to be construed as embodying all modifications and alternative constructions that may occur to one skilled in the art that fairly fall within the basic teaching herein set forth.